CVE-2026-33439 PoC — OpenAM 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-33439.yaml

Associated Vulnerability

Title:OpenAM 代码问题漏洞 (CVE-2026-33439)
Description:OpenAM是OpenAM Consortium组织的一种一体化访问管理解决方案。提供身份验证、授权、授权和联合功能。 OpenAM 16.0.6之前版本存在代码问题漏洞，该漏洞源于jato.clientSession参数存在不安全的Java反序列化，可能导致远程代码执行。

Description

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464.  This vulnerability is fixed in 16.0.6.

File Snapshot


 id: CVE-2026-33439

info:
  name: OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserializa

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!